PatchTheCVECVE-2026-16280: An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of addre
CVE-2026-16280 is a critical-severity flaw (CVSS 9.8) affecting ddk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.
Why this priority
- Critical severity
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 56%) |
| CISA exploited list | No |
| Weakness | CWE-190 |
| Published | 2026-07-24 |
| Last modified | 2026-10-24 |
Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-16280?
ddk: upgrade to 26.1. Exact commands for each OS are on this page.
Is CVE-2026-16280 being exploited?
CVE-2026-16280 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-16280 affect?
CVE-2026-16280 affects ddk. Severity is critical (CVSS 9.8). An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trig
How urgent is CVE-2026-16280?
Priority 53/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-49743 HIGH 7.8 UPGRADE Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the li
- CVE-2026-49744 HIGH 7.8 UPGRADE Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trig
- CVE-2026-49745 HIGH 7.8 UPGRADE Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trig